Looking behind and beyond self-similarity: On scaling phenomena in measured WAN traffic (original) (raw)
Related papers
Looking behind and beyond self-similarity: On scaling phenomena in measured WAN tra c
1997
In this paper, we report on some preliminary results from an in-depth, wavelet-based analysis of a set of high-quality, packet-level tra c measurements, collected over the last 6-7 years from a number of di erent working wide-area networks (WANs). We rst validate and con rm an earlier nding, originally due to Paxson and Floyd 10], that actual WAN tra c is consistent with statistical self-similarity for su ciently large time scales. Second, we illustrate that TCP tra c characteristics have undergone major changes within the last 3-4 years, because of the increasing popularity of the Web (WWW) and its emergence as the major contributor to WAN tra c. Finally, we provide empirical evidence that actual WAN tra c traces also exhibit scaling properties over small time scales, but that the small-time scaling phenomenon is distinctly di erent from the observed large-time scaling property. We relate this newly observed characteristic of WAN tra c to the e ects that the dominant network protocols (e.g., TCP) and controls have on the ow of packets across the network, and discuss the potential that multifractals have for providing a structural modeling approach for WAN tra c that captures in a compact and parsimonious manner the observed scaling phenomena at large as well as small time scales.
The Changing Nature of Network Traffic: Scaling Phenomena
1997
In this paper, we report on some preliminary results from an in-depth, wavelet-based analysis of a set of high-quality, packet-level tra c measurements, collected over the last 6-7 years from a number of di erent working wide-area networks (WANs). We rst validate and con rm an earlier nding, originally due to Paxson and Floyd 12], that actual WAN tra c is consistent with statistical self-similarity for su ciently large time scales. We then relate this large-time scaling phenomenon to the empirically observed characteristics of WAN tra c at the level of individual connections or applications. In particular, we present here original results about a detailed statistical analysis of Web-session characteristics, and report on an intriguing scaling property of measured WAN tra c at the transport layer (i.e., number of TCP connection arrivals per time unit). This scaling property of WAN tra c at the TCP layer was absent in the pre-Web period but has become ubiquitous in today's WWW-dominated WANs and is a direct consequence of the ever-increasing popularity of the Web (WWW) and its emergence as the major contributor to WAN tra c. Moreover, we show that this changing nature of WAN tra c can be naturally accounted for by self-similar tra c models, primarily because of their ability to provide physical explanations for empirically observed tra c phenomena in a networking context. Finally, we provide empirical evidence that actual WAN tra c traces also exhibit scaling properties over small time scales, but that the small-time scaling phenomenon is distinctly di erent from the observed large-time scaling property. We relate this newly observed characteristic of WAN tra c to the e ects that the dominant network protocols (e.g., TCP) and controls have on the ow of packets across the network and discuss the potential that multifractals have in this context for providing a structural modeling approach for WAN tra c and for capturing in a compact and parsimonious manner the observed scaling phenomena at large as well as small time scales.
The changing nature of network traffic
ACM SIGCOMM Computer Communication Review, 1998
In this paper, we report on some preliminary results from an in-depth, wavelet-based analysis of a set of high-quality, packet-level tra c measurements, collected over the last 6-7 years from a number of di erent working wide-area networks (WANs). We rst validate and con rm an earlier nding, originally due to Paxson and Floyd 12], that actual WAN tra c is consistent with statistical self-similarity for su ciently large time scales. We then relate this large-time scaling phenomenon to the empirically observed characteristics of WAN tra c at the level of individual connections or applications. In particular, we present here original results about a detailed statistical analysis of Web-session characteristics, and report on an intriguing scaling property of measured WAN tra c at the transport layer (i.e., number of TCP connection arrivals per time unit). This scaling property of WAN tra c at the TCP layer was absent in the pre-Web period but has become ubiquitous in today's WWW-dominated WANs and is a direct consequence of the ever-increasing popularity of the Web (WWW) and its emergence as the major contributor to WAN tra c. Moreover, we show that this changing nature of WAN tra c can be naturally accounted for by self-similar tra c models, primarily because of their ability to provide physical explanations for empirically observed tra c phenomena in a networking context. Finally, we provide empirical evidence that actual WAN tra c traces also exhibit scaling properties over small time scales, but that the small-time scaling phenomenon is distinctly di erent from the observed large-time scaling property. We relate this newly observed characteristic of WAN tra c to the e ects that the dominant network protocols (e.g., TCP) and controls have on the ow of packets across the network and discuss the potential that multifractals have in this context for providing a structural modeling approach for WAN tra c and for capturing in a compact and parsimonious manner the observed scaling phenomena at large as well as small time scales.
Multifractality in TCP/IP traffic: the case against
Computer Networks, 2005
The discovery of long-range dependence (a kind of asymptotic fractal scaling) in packet data from LANs and WANs, was followed by further work detailing evidence for multifractal behaviour in TCP/IP traffic in WANs. In terms of networking however, physical mechanisms for such behaviour have never been convincingly demonstrated, leaving open the question of whether multifractal traffic models are of black box type, or alternatively if there is anything ÔrealÕ behind them. In this paper we review the evidence for multifractal behaviour of aggregate TCP traffic, and show that in many ways it is weak. Our study includes classic traces and very recent ones. We point out misunderstandings in the literature concerning the scales over which multifractality has been claimed. We explain other pitfalls which have led to the multifractal case being overstated, in particular the possibility of Ôpseudo scalingÕ being confused with true scaling, due to shortcomings in the statistical tools. We argue for an alternative point process model with strong physical meaning. It reproduces the higher order statistics of the data well, despite not being calibrated for them, yet is not multifractal. From its standpoint, the empirical multifractal behaviour is seen as a misinterpretation due to a lack of power in the statistical methodology.
Small-time scaling behavior of Internet backbone traffic
Computer Networks, 2005
We perform an extensive wavelet analysis of Internet backbone traffic traces to observe and understand the causes of small-time scaling phenomena present in them. We observe that for a majority of the traces, the second-order scaling exponents at small time scales (1-100 ms) are fairly close to 0.5, indicating that traffic fluctuations at these time scales are nearly uncorrelated. Some traces, however, do exhibit moderately large scaling exponents (%0.7) at small time scales. In addition, the traces manifest mostly monofractal behaviors at small time scales. To identify the network causes of the observed scaling behavior, we analyze the flow composition of the traffic along two dimensions-flow byte contribution and flow density. Our study points to the dense flows (i.e., flows with densely clustered packets) as the correlation-causing factor in small time scales, and reveals that the traffic composition in terms of proportions of dense vs. sparse flows plays a major role in influencing the small-time scalings of aggregate traffic. Since queuing inside routers is influenced by traffic fluctuations at small time-scales, our observations and results have important implications for networking modeling, service provisioning and traffic engineering.
IEEE/ACM Transactions on Networking, 2017
In the mid-90's, it was shown that the statistics of aggregated time series from Internet traffic departed from those of traditional short range dependent models, and were instead characterized by asymptotic self-similarity. Following this seminal contribution, over the years, many studies have investigated the existence and form of scaling in Internet traffic. This contribution aims first at presenting a methodology, combining multiscale analysis (wavelet and wavelet leaders) and random projections (or sketches), permitting a precise, efficient and robust characterization of scaling which is capable of seeing through non-stationary anomalies. Second, we apply the methodology to a data set spanning an unusually long period: 14 years, from the MAWI traffic archive, thereby allowing an in-depth longitudinal analysis of the form, nature and evolutions of scaling in Internet traffic, as well as network mechanisms producing them. We also study a separate 3-day long trace to obtain complementary insight into intra-day behavior. We find that a biscaling (two ranges of independent scaling phenomena) regime is systematically observed: long-range dependence over the large scales, and multifractal-like scaling over the fine scales. We quantify the actual scaling ranges precisely, verify to high accuracy the expected relationship between the long range dependent parameter and the heavy tail parameter of the flow size distribution, and relate fine scale multifractal scaling to typical IP packet inter-arrival and to round-trip time distributions.
Does fractal scaling at the IP level depend on TCP flow arrival processes?
Proceedings of the second ACM SIGCOMM Workshop on Internet measurment - IMW '02, 2002
In addition to the well known long-range dependence in time series of IP bytes and packets, evidence for scaling behaviour has also been found at small scales for these series, separated by a characteristic transition timescale. It is less well known that two scaling regimes are also commonly found in time series describing the arrivals of TCP flows, again with long-range dependence, and with a broadly similar scaling exponent at small scales. The transition timescale is also roughly similar to that found in the IP level case. We investigate the dependencies between the scaling behaviours of the IP and TCP arrival levels at both small and large scales. We also study the origin of scaling at small scales at the IP level. The arrival level process is important to study both for its potential impact on the IP level, and in its own right, for example for web server performance. Our findings are based on gigabytes of high precision packet level data collected at multiple locations. The analysis methodology combines models with real data in a 'semi-experimental' approach which reduces the need for modelling assumptions. Flows and packets are individually manipulated to selectively isolate the components of scaling due to packet dynamics within a TCP flow, the dependencies between flows, their durations and packet counts, and the flow arrival process. The scaling behaviour is analysed using wavelet based methods.
A multiplicative multifractal model for TCP traffic
Proceedings. Sixth IEEE Symposium on Computers and Communications, 2001
Recent studies have shown that TCP traffic displays strong multifractal scaling. However, a physical explanation of why such a behavior occurs is still eluding. In this paper, we propose a cascade model that is based on the retransmission and congestion avoidance mechanisms of TCP. At the same time, it relates to the physical, tree-like organization of networks. This model allows to relate the most salient multifractal features with basic traffic parameters as the RTT and the loss probability. Numerical experiments confirm that such a parsimonious model is able to give a satisfactory explanation for a number of features pertaining to multifractality, including the range of scales where it is observed. We believe these results open the way to a more profound understanding of the small time scale properties of TCP traffic.
Exploring regularities and self-similarity in Internet traffic
The characterization and quantitative description of Internet traffic is becoming increasingly important in light of the rapid growth being observed in the size and usage of the network. Modeling of modern teletraffic and large telecommunications networks with fractal stochastic processes has been investigated by analyzing traffic measurements collected on the "Federico II" university WAN link to the National Research Network backbone, and using them to test the existence of fractal behavior and specific properties. A fractal character with approximate selfsimilarity and statistical long-range dependence has been observed in the Internet access traffic measurements. This approach leads to some interesting insights about whether and how regularities in Internet user behavior can be noticed and exploited. The derived characterization could be seen as a first step to a generalized parametric Internet traffic model.